1715151 - Crash in [@ mozilla::a11y::HTMLLIAccessible::BoundsInAppUnits]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

Crash report: https://crash-stats.mozilla.org/report/index/982acccd-8d95-42da-9dd0-0d4100210607

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so mozilla::a11y::HTMLLIAccessible::BoundsInAppUnits const accessible/html/HTMLListAccessible.cpp:58
1 libxul.so mozilla::a11y::LocalAccessible::Bounds const accessible/generic/LocalAccessible.cpp:694
2 libxul.so mozilla::a11y::DocAccessibleWrap::HandleAccEvent accessible/android/DocAccessibleWrap.cpp:76
3 libxul.so nsEventShell::FireEvent accessible/base/nsEventShell.cpp:43
4 libxul.so mozilla::a11y::DocAccessible::DispatchScrollingEvent accessible/generic/DocAccessible.cpp:2773
5 libxul.so mozilla::a11y::RootAccessible::HandleEvent accessible/generic/RootAccessible.cpp:236
6 libxul.so {virtual override thunk} 
7 libxul.so mozilla::EventListenerManager::HandleEventSubType dom/events/EventListenerManager.cpp:1114
8 libxul.so mozilla::EventListenerManager::HandleEventInternal dom/events/EventListenerManager.cpp:1305
9 libxul.so mozilla::EventTargetChainItem::HandleEventTargetChain dom/events/EventDispatcher.cpp:487

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

[Tracking Requested - why for this release]: possible crash regression.

Comment 2

[Julien Cristau [:jcristau]]

20210505095249 looks to be the first Fenix/GV buildid with this crash.

Comment 3

[Julien Cristau [:jcristau]]

Bug 1513447 touched this code.

Comment 4

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1715151 - Check if we have a frame for HTMLLIAccessible when getting bounds. r?morgan

I'm not sure in what markup/style scenario a list item accessible
wouldn't have a frame, but would have a bullet. Apparently that can
happen in the wild. Added an assertion, hopefully we can trip it on
something reproducable in the future.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/700fc3dd5142
Check if we have a frame for HTMLLIAccessible when getting bounds. r=morgan

Comment 6

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/700fc3dd5142

Comment 7

[Julien Cristau [:jcristau]]

Please request beta uplift when you get a chance.

Comment 8

[Morgan Reschenberg [:morgan]]

Comment on attachment 9226193 [details]
Bug 1715151 - Check if we have a frame for HTMLLIAccessible when getting bounds. r?morgan

Beta/Release Uplift Approval Request

• User impact if declined: If declined, users may continue to see crashes when they encounter bullets without frames in the wild.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: We aren't sure how to reproduce this crash, so unfortunately we can't ask for a test here :(
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch adds a null check before querying the frame's bounds. It also includes an assertion so we can (hopefully) figure out what kinds of HTML users are encountering in the wild that produces a bullet but no frame.
• String changes made/needed:

Comment 9

[Julien Cristau [:jcristau]]

Comment on attachment 9226193 [details]
Bug 1715151 - Check if we have a frame for HTMLLIAccessible when getting bounds. r?morgan

approved for 90.0b11

Comment 10

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a91636ab859b